topic Re: Sinkhole vs whitelising url in General Topics

Sinkhole vs whitelising url

gfleming — Wed, 10 Aug 2022 17:41:40 GMT

Does the sinkhole take precedence over whitelisting? We whitelisted a url and are sinkholing parked categories. I can request to have the category changed, but was not sure which took precedence.

Re: Sinkhole vs whitelising url

JayGolf — Fri, 12 Aug 2022 05:32:09 GMT

Hi @gfleming,

That's an interesting question. Whitelisting a URL and Sinkhole fall under content inspection in the packet flow sequence in PAN-OS. Security profiles are checked through content inspection, but I cannot find a hard answer on which profiles are examined first. My first assumption would be starting at the top and going down.

Re: Sinkhole vs whitelising url

santonic — Fri, 12 Aug 2022 10:36:19 GMT

Sinkholing is a DNS action. URL filtering works on http/https connections.

When you try to visit a website, you have to resolve the FQDN (www.google.com) first. So DNS query happens first. Only after that a client (browser) knows where to send traffic (a http connection) to.

So whitelisting a URL doesn't help because the DNS query was blocked before there was any http/https connection.